Skip to content
OpenAdvisories

Package · Debian

pdm

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.4
    CVE-2026-47781

    pdm: Project-Controlled `.pdm-plugins` Content Executes Before CLI Parsing

    PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins directory during initialization, allowing an attacker-controlled file in an untrusted repository checkout…

    pdm-project pdm pdm pdm Debian Ubuntu PyPI
  • High 8.4
    CVE-2026-47764

    pdm: Path traversal in wheel installation via overridden write_to_fs

    pdm is a Python package and dependency manager supporting the latest PEP standards. Versions prior to 2.27.0 are vulnerable to path traversal through write_to_fs. InstallDestination.write_to_fs() in src/pdm/installers/installers.py overrides the base class to…

    pdm-project pdm pdm pdm Debian Ubuntu PyPI
  • High 7.8
    CVE-2023-45805

    Trojan Lockfilein pdm

    pdm is a Python package and dependency manager supporting the latest PEP standards. It's possible to craft a malicious `pdm.lock` file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actua…

    pdm-project pdm pdm pdm Debian Ubuntu PyPI